[TalkingCodeMonk]

FYI the setup you mention is not "end-to-end" encrypted. E2EE means client-to-client encrypted, with the server processing encrypted bits only. Your approach is encryption in transit and at rest. At rest is relatively irrelevent for large cloud providers, as they are probably better at managing the lifecycle of disks than most businesses or people. It's unlikely someone's going to physically rob a data center or end up with a refurb drive that hasn't been thoroughly processed and wiped.

It's not necessarily more secure than managed providers either, simply because you are probably not a security engineer, and have far less resources to secure your server. It does prevent Google/iCloud from scraping your data, but it certainly does not mean Hetzner can't access your data. They control the overarching hypervisor and control plane managing your servers/VM's, so there's no way to know what capabilities have been implemented. The majority of what intelligence agencies are capable of has not been leaked or documented publicly.

[FabCH]

I do happen to have some experience.

For 99.99% of the population, does the threat model really include targeted NSA attack with higher probability than „Google’s automated system sent the police to my door“? No, no it doesn’t.

It is demonstrably more secure for even a semi experienced sysop to host Immich for their family than for them to use Google/Apple.

But I do agree that _some_ experience is required.

[smallerize]

Hetzner has fewer employees I guess, but since your photos are decrypted there, you have basically the same problem.

[FabCH]

In memory. If the police shows up and they disconnect my server to sieze it, for example, the photos are lost to them.

And the Hetzner employee would need to specifically target me, because I doubt they would implement a dragnet that pierces through the bespoke random process on my bare metal server to scan the photos in memory.

That is a lot more secure than „Google scans all pictures routinely and fully automatically sends the police to your door, and you have no recourse if they are wrong“ that the EFF article discussed.

[bigntallmike]

He's understandably using the wrong term because E2EE should include private servers as a variant, but does not by definition. In the case where I own the server end of the communication, the data being fully encrypted on that server is far less important than when it is stored in the cloud. The effect is the same however, since sending encrypted photos over HTTPS to be decrypted client side would be completely unnecessary in most cases.